mirror of
https://github.com/python-pillow/Pillow.git
synced 2025-07-09 15:52:37 +03:00
Fix buffer overflow when saving compressed DDS images (#9041)
Co-authored-by: Eric Soroos <eric-github@soroos.net>
This commit is contained in:
parent
e783aff688
commit
ef98b3510e
|
@ -511,3 +511,20 @@ def test_save_dx10_bc5(tmp_path: Path) -> None:
|
|||
im = hopper("L")
|
||||
with pytest.raises(OSError, match="only RGB mode can be written as BC5"):
|
||||
im.save(out, pixel_format="BC5")
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
"pixel_format, mode",
|
||||
(
|
||||
("DXT1", "RGBA"),
|
||||
("DXT3", "RGBA"),
|
||||
("DXT5", "RGBA"),
|
||||
("BC2", "RGBA"),
|
||||
("BC3", "RGBA"),
|
||||
("BC5", "RGB"),
|
||||
),
|
||||
)
|
||||
def test_save_large_file(tmp_path: Path, pixel_format: str, mode: str) -> None:
|
||||
im = hopper(mode).resize((440, 440))
|
||||
# should not error in valgrind
|
||||
im.save(tmp_path / "img.dds", pixel_format=pixel_format)
|
||||
|
|
|
@ -258,6 +258,10 @@ ImagingBcnEncode(Imaging im, ImagingCodecState state, UINT8 *buf, int bytes) {
|
|||
UINT8 *dst = buf;
|
||||
|
||||
for (;;) {
|
||||
// Loop writes a max of 16 bytes per iteration
|
||||
if (dst + 16 >= bytes + buf) {
|
||||
break;
|
||||
}
|
||||
if (n == 5) {
|
||||
encode_bc3_alpha(im, state, dst, 0);
|
||||
dst += 8;
|
||||
|
|
Loading…
Reference in New Issue
Block a user